Severity: High
CVE ID: CVE-2026-95646
Affected Software Version(s): DDI Central 6.3.0 / Build 6300 and below
Fixed Version: Build 6500
Fixed on: September 17, 2026
Details:
ManageEngine DDI Central 6.3.0 build 6300 had a command injection vulnerability in the Cisco IOS DHCP configuration workflow.
The application validated conventional ASCII control characters in DHCP input fields but did not adequately detect certain Unicode separator characters. Specifically, a Unicode LINE SEPARATOR character (U+2028) supplied through the DHCP pool client_name field could be accepted and stored in the database. The stored value was subsequently incorporated into the command stream generated for a managed Cisco IOS device.
Because Cisco IOS interprets U+2028 as a command separator, an authenticated non-administrator operator with DHCP edit permissions for a cluster containing a Cisco device could craft a value that caused additional Cisco IOS commands to be executed on that managed device. The reported issue did not require administrator privileges, user interaction, or access to another cluster.
The vulnerability has been fixed by introducing additional character validation for DHCP input values used in Cisco IOS configuration commands. Unsafe Unicode separator characters are now detected and rejected before the values can be persisted and subsequently used during command generation. Existing input sanitization remains in place for other restricted characters.
Impact:
Successful exploitation of this vulnerability could allow an authenticated cluster-scoped DHCP operator to execute unintended Cisco IOS commands on a managed network device within the operator's authorized cluster.
Depending on the privileges of the Cisco account used by DDI Central, such commands could potentially be used to view or modify device configuration, routing information, access control lists, credentials, forwarding behavior, or other configuration accessible to that account. The reported proof of concept demonstrated command execution using a non-destructive command.
Steps to upgrade:
Update your DDI Central Console to the fixed build or later using the corresponding service pack. Customers using Cisco IOS DHCP management are strongly recommended to upgrade to the fixed version.
Acknowledgements:
This issue was reported by sealldev.